ropshell> use 911ddf2e16761643a47225f654d811e5 (download)
name         : ntdll.dll (i386/PE)
base address : 0x7c901000
total gadgets: 6968

ropshell> suggest "stack pivoting"
> 0x7c918bfe : xchg eax, esp; ret
> 0x7c972e3d : mov esp, ebx; pop ebx; ret
> 0x7c90e502 : mov esp, ebp; pop ebp; ret
> 0x7c90118a : mov esp, esi; pop ebx; pop edi; pop esi; pop ebp; ret 0x10
> 0x7c92d9e6 : lea esp, [esi + edi*8]; dec ecx; ret 0x10
> 0x7c901109 : lea esp, [esp];  dec [edx + 4]; ret 4
> 0x7c975809 : xchg esp, edx; add [eax], al; add [ebx], bh; ret
> 0x7c94f924 : xchg esp, esi; sar ch, 1; jmp [ebx]
> 0x7c90162c : mov esp, ecx; mov ecx, [eax]; mov eax, [eax + 4]; push eax; ret
> 0x7c915745 : lea esp, [edx]; or al, [eax]; add [edi + 0xffffffc9], bl; ret 0x10
> 0x7c960bb5 : lea esp, [edi + edi*8 + 0xffffffff]; call [ecx + 0xffffffff]
> 0x7c9018df : leave ; ret